90 matches found
CVE-2020-10116
CVE-2020-10116 affects cPanel prior to 84.0.20. An attacker can bypass restrictions on features and demo accounts via WebDisk UAPI calls, enabling a restriction-bypass condition (SEC-541). The issue is tied to versions before 84.0.20; upgrade to 84.0.20 or later to remediate.
CVE-2020-10116: Missing Authorization
cPanel before 84.0.20 allows attackers to bypass intended restrictions on features and demo accounts via WebDisk UAPI calls SEC-541...
CVE-2020-10117: Undefined Security Weakness
cPanel before 84.0.20 mishandles enforcement of demo checks in the Market UAPI namespace SEC-542...
CVE-2018-10465
Jamf Pro 10.x before 10.3.0 has Incorrect Access Control. Jamf Pro user accounts and groups with access to log in to Jamf Pro had full access to endpoints in the Universal API UAPI, regardless of account privileges or privilege sets. An authenticated Jamf Pro account without required privileges...
Information disclosure
Jamf Pro 10.x before 10.3.0 has Incorrect Access Control. Jamf Pro user accounts and groups with access to log in to Jamf Pro had full access to endpoints in the Universal API UAPI, regardless of account privileges or privilege sets. An authenticated Jamf Pro account without required privileges...
CVE-2018-10465
CVE-2018-10465 affects Jamf Pro 10.x before 10.3.0, where users with login access had full CRUD rights to the Universal API (UAPI) endpoints, regardless of privileges. Root cause: Incorrect Access Control allowing unauthorized information disclosure, compromised data integrity, and potential data...
CVE-2018-10465
Jamf Pro 10.x before 10.3.0 has Incorrect Access Control. Jamf Pro user accounts and groups with access to log in to Jamf Pro had full access to endpoints in the Universal API UAPI, regardless of account privileges or privilege sets. An authenticated Jamf Pro account without required privileges...
CVE-2018-10465: Undefined Security Weakness
Jamf Pro 10.x before 10.3.0 has Incorrect Access Control. Jamf Pro user accounts and groups with access to log in to Jamf Pro had full access to endpoints in the Universal API UAPI, regardless of account privileges or privilege sets. An authenticated Jamf Pro account without required privileges...
CVE-2019-14411
cPanel before 78.0.2 does not properly restrict demo accounts from writing to files via the DCV UAPI SEC-473...
CVE-2019-14410
Maketext in cPanel before 78.0.2 allows format-string injection in the Email storefilter UAPI SEC-472...
CVE-2019-14412
Maketext in cPanel before 78.0.2 allows format-string injection in the DCV checkdomainsviadns UAPI SEC-474...
Design/Logic Flaw
cPanel before 78.0.2 does not properly restrict demo accounts from writing to files via the DCV UAPI SEC-473...
Format string
Maketext in cPanel before 78.0.2 allows format-string injection in the DCV checkdomainsviadns UAPI SEC-474...
Format string
Maketext in cPanel before 78.0.2 allows format-string injection in the Email storefilter UAPI SEC-472...
CVE-2019-14412
Maketext in cPanel before 78.0.2 allows format-string injection in the DCV checkdomainsviadns UAPI SEC-474...
CVE-2019-14412
CVE-2019-14412 affects cPanel before 78.0.2, where the Maketext function can perform a format-string injection via the DCV domain validation via DNS UAPI (SEC-474). The underlying issue is a formatting string handling flaw in Maketext, enabling injection within the DCV check_domains_via_dns UAPI....
CVE-2019-14411
CVE-2019-14411 affects cPanel prior to 78.0.2. The vulnerability arises because the DCV UAPI does not properly restrict demo accounts from writing to files, enabling an attacker to write to files via the DCV UAPI (SEC-473). Impact is implicit in the description: unauthorized file writes by demo a...
CVE-2019-14411
cPanel before 78.0.2 does not properly restrict demo accounts from writing to files via the DCV UAPI SEC-473...